registry / merrymen / 0.9.5

merrymen@0.9.5

Trading agents you never have to trust — self-hosted, keys stay on your machine, caps enforced by the account contract on-chain. For Robinhood Chain; Telegram control; write-your-own strategies.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 15 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 87 file(s), 613 KB of source, external domains: api.groq.com, api.openai.com, api.pimlico.io, api.telegram.org, blue-api.morpho.org, cdn.robinhood.com, console.anthropic.com, console.groq.com, dashboard.pimlico.io, docs.rialto.xyz, explorer.testnet.chain.robinhood.com, faucet.testnet.chain.robinhood.com, merrymen.dev, nodejs.org, rialto-trade-api.rialto.xyz, robinhoodchain.blockscout.com, rpc.mainnet.chain.robinhood.com, rpc.testnet.chain.robinhood.com, t.me, www.w3.org

Source & flagged code

7 flagged

cli/bin.mjsView file

Lines 2-42javascript

2/**

3 * merrymen CLI — the terminal front door.

4 *

5 * Install (no clone): npm install -g merrymen (or github:millw14/merrymen)

6 * Then: merrymen onboard && merrymen start

7 *

8 * merrymen onboard interactive setup wizard (keys, strategy, basket)

9 * merrymen start run web + worker together

10 * merrymen doctor diagnose the whole stack

11 * merrymen status what the band is doing right now

12 * merrymen strategy new scaffold a custom strategy in ~/.merrymen/strategies

13 * merrymen strategy list builtins + your strategies

14 * merrymen selftest one policy-legal no-op through the full pipeline

15 * merrymen kill terminal kill switch (deletes the grant)

16 * merrymen wallets every wallet on this machine (live + archived) + balances

17 * merrymen recover sweep the smart account's funds to a wallet you control

18 *

19 * Zero dependencies. All user data lives in ~/.merrymen (override with

20 * MERRYMEN_HOME) — the install location stays disposable.

21 */

23import { spawn, spawnSync } from "node:child_process";

24import { copyFileSync, existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";

High

Child Process

Package source references child process execution.

cli/bin.mjsView on unpkg · L22

25import { readdir } from "node:fs/promises";

26import os from "node:os";

27import path from "node:path";

28import readline from "node:readline";

29import { fileURLToPath } from "node:url";

30import { banner, c, spinner, type as typeOut, withSpinner } from "./ui.mjs";

32// Where the PACKAGE lives (npm global dir or a checkout) — code, never data.

33const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");

34// Where the USER's data lives — settings, grant, ledger, strategies.

35const HOME = process.env.MERRYMEN_HOME ?? path.join(os.homedir(), ".merrymen");

36const SETTINGS = path.join(HOME, "settings.json");

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

cli/bin.mjsView on unpkg · L22

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

cli/bin.mjsView on unpkg · L22

37const GRANT = path.join(HOME, "grant.json");

38const HEARTBEAT = path.join(HOME, "heartbeat.json");

39const DB = path.join(HOME, "merrymen.db");

40const STRATEGIES = path.join(HOME, "strategies");

41// Every wallet this machine has armed — one file per smart account. grant.json is

42// a single slot, so replacing or killing a wallet archives the old one here first

Lines 128-168javascript

128 return files

129 .filter((f) => /\.(ts|mts|mjs|js)$/.test(f) && !f.startsWith("."))

130 .map((f) => f.replace(/\.(ts

Lines 1071-1111javascript

1071

1072 const resolved =

1073 process.platform === "win32" ? sh("where", ["merrymen"]) : sh("which", ["merrymen"]);

1074 resolved

1075 ? ok(`merrymen resolves ${dim(resolved

worker/src/strategies/custom.tsView file

Lines 115-155typescript

115interface LoadedModule {

116 mtimeMs: number;

117 strategy: { name?: string; tick: (snap: Snapshot, ctx: StrategyCtx) => unknown }

web/.next/static/media/851c4691abdf3def-s.woff2View file

•path = web/.[redacted]-s.woff2 kind = high_entropy_blob sizeBytes = 9364 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

web/.next/static/media/851c4691abdf3def-s.woff2View on unpkg

Source & flagged code

7 flagged · loading source

cli/bin.mjsView file

22L23: import { spawn, spawnSync } from "node:child_process"; L24: import { copyFileSync, existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";

High

Child Process

Package source references child process execution.

cli/bin.mjsView on unpkg · L22

148const line = `${q(bin)} ${args.map(q).join(" ")}`; L149: return runner(line, { ...opts, shell: true, windowsHide: true }); L150: }

High

Shell

Package source references shell execution.

cli/bin.mjsView on unpkg · L148

22L23: import { spawn, spawnSync } from "node:child_process"; L24: import { copyFileSync, existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs"; ... L34: // Where the USER's data lives — settings, grant, ledger, strategies. L35: const HOME = process.env.MERRYMEN_HOME ?? path.join(os.homedir(), ".merrymen"); L36: const SETTINGS = path.join(HOME, "settings.json"); ... L47: L48: const RPC_MAINNET = "https://rpc.mainnet.chain.robinhood.com"; L49: const RPC_TESTNET = "https://rpc.testnet.chain.robinhood.com"; ... L71: try { L72: return JSON.parse(readFileSync(file, "utf8").replace(/^/, "")); L73: } catch {

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

cli/bin.mjsView on unpkg · L22

1091* Self-update. A running dashboard/worker holds file locks inside the global L1092: * install, so a bare `npm i -g merrymen@latest` dies with EBUSY on Windows. L1093: * This stops the band's child processes (NOT this CLI — the pattern matches ... L1104: "ForEach-Object { Stop-Process -Id $_.ProcessId -Force }"; L1105: spawnSync("powershell", ["-NoProfile", "-Command", ps], { stdio: "ignore" }); L1106: } else {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

cli/bin.mjsView on unpkg · L1091

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

cli/bin.mjsView on unpkg · L22

worker/src/strategies/custom.tsView file

135const note = opts?.onNote ?? ((l, m) => console.log(`[custom:${l}] ${m}`)); L136: const importer = opts?.importer ?? ((url) => import(url)); L137: const ctx = buildStrategyCtx();

Medium

Dynamic Require

Package source references dynamic require/import behavior.

worker/src/strategies/custom.tsView on unpkg · L135

web/.next/static/media/851c4691abdf3def-s.woff2View file

•path = web/.[redacted]-s.woff2 kind = high_entropy_blob sizeBytes = 9364 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

web/.next/static/media/851c4691abdf3def-s.woff2View on unpkg

Findings

5 High5 Medium5 Low

HighChild Processcli/bin.mjs

HighShellcli/bin.mjs

HighSandbox Evasion Gated Capabilitycli/bin.mjs

HighRuntime Package Installcli/bin.mjs

HighShips High Entropy Blobweb/.next/static/media/851c4691abdf3def-s.woff2

MediumDynamic Requireworker/src/strategies/custom.ts

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencecli/bin.mjs

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

7 flagged

cli/bin.mjsView file

Lines 2-42javascript

2/**

3 * merrymen CLI — the terminal front door.

4 *

5 * Install (no clone): npm install -g merrymen (or github:millw14/merrymen)

6 * Then: merrymen onboard && merrymen start

7 *

8 * merrymen onboard interactive setup wizard (keys, strategy, basket)

9 * merrymen start run web + worker together

10 * merrymen doctor diagnose the whole stack

11 * merrymen status what the band is doing right now

12 * merrymen strategy new scaffold a custom strategy in ~/.merrymen/strategies

13 * merrymen strategy list builtins + your strategies

14 * merrymen selftest one policy-legal no-op through the full pipeline

15 * merrymen kill terminal kill switch (deletes the grant)

16 * merrymen wallets every wallet on this machine (live + archived) + balances

17 * merrymen recover sweep the smart account's funds to a wallet you control

18 *

19 * Zero dependencies. All user data lives in ~/.merrymen (override with

20 * MERRYMEN_HOME) — the install location stays disposable.

21 */

23import { spawn, spawnSync } from "node:child_process";

24import { copyFileSync, existsSync, mkdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";

High

Child Process

Package source references child process execution.

cli/bin.mjsView on unpkg · L22

25import { readdir } from "node:fs/promises";

26import os from "node:os";

27import path from "node:path";

28import readline from "node:readline";

29import { fileURLToPath } from "node:url";

30import { banner, c, spinner, type as typeOut, withSpinner } from "./ui.mjs";

32// Where the PACKAGE lives (npm global dir or a checkout) — code, never data.

33const ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");

34// Where the USER's data lives — settings, grant, ledger, strategies.

35const HOME = process.env.MERRYMEN_HOME ?? path.join(os.homedir(), ".merrymen");

36const SETTINGS = path.join(HOME, "settings.json");

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

cli/bin.mjsView on unpkg · L22

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

cli/bin.mjsView on unpkg · L22

37const GRANT = path.join(HOME, "grant.json");

38const HEARTBEAT = path.join(HOME, "heartbeat.json");

39const DB = path.join(HOME, "merrymen.db");

40const STRATEGIES = path.join(HOME, "strategies");

41// Every wallet this machine has armed — one file per smart account. grant.json is

42// a single slot, so replacing or killing a wallet archives the old one here first

Lines 128-168javascript

128 return files

129 .filter((f) => /\.(ts|mts|mjs|js)$/.test(f) && !f.startsWith("."))

130 .map((f) => f.replace(/\.(ts

Lines 1071-1111javascript

1071

1072 const resolved =

1073 process.platform === "win32" ? sh("where", ["merrymen"]) : sh("which", ["merrymen"]);

1074 resolved

1075 ? ok(`merrymen resolves ${dim(resolved

worker/src/strategies/custom.tsView file

Lines 115-155typescript

115interface LoadedModule {

116 mtimeMs: number;

117 strategy: { name?: string; tick: (snap: Snapshot, ctx: StrategyCtx) => unknown }

web/.next/static/media/851c4691abdf3def-s.woff2View file

•path = web/.[redacted]-s.woff2 kind = high_entropy_blob sizeBytes = 9364 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

web/.next/static/media/851c4691abdf3def-s.woff2View on unpkg